dd9da51462
openssl: enable OPENSSL_WITH_DEPRECATED when OpenSSL is built as a build dep
...
Some package (e.g. libunbound) depend on OPENSSL_WITH_DEPRECATED. In some
situations it may happen that libunbound and openssl are only pulled in as
build dependencies, but are not enabled in .config.
In such cases, the defaults of symbols like OPENSSL_WITH_DEPRECATED are
ignored (as the whole symbol depends on PACKAGE_libopenssl), and config
symbol dependencies of libunbound aren't effective either (as libunbound
is not actually enabled).
This commit works around the issue by introducing a hidden negated symbol
OPENSSL_NO_DEPRECATED, which is always disabled when PACKAGE_libopenssl is
disabled, and ensures that OpenSSL is built with deprecated APIs in this
case. A user can still manage to break the build by explicitly enabling
libopenssl and disabling OPENSSL_WITH_DEPRECATED; the interaction between
build dependencies and config symbols will require further discussion.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
2018-10-30 20:38:34 +01:00
dca96b7546
openssl: Add optimization option
...
Add option to optimize for speed instead of size
cmd: openssl speed md5 sha1 sha256 sha512 des des-ede3 aes-128-cbc \
aes-192-cbc aes-256-cbc rsa2048 dsa2048
=== Linksys WRT3200ACM ===
Default optimization:
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
md5 14111.49k 47147.75k 123375.02k 206937.09k 258828.97k
sha1 14495.71k 46763.99k 116679.94k 188115.29k 228294.66k
des cbc 22315.63k 23118.98k 23323.14k 23348.22k 23363.58k
des ede3 8085.97k 8217.26k 8255.74k 8266.41k 8273.92k
aes-128 cbc 48740.10k 52606.12k 54224.98k 56263.68k 54774.44k
aes-192 cbc 43410.83k 47325.31k 48994.05k 49377.96k 48532.14k
aes-256 cbc 39132.46k 42512.60k 43692.63k 43997.18k 44070.23k
sha256 19987.80k 47314.69k 86119.08k 109352.28k 119466.67k
sha512 8034.63k 32321.92k 47495.94k 65777.32k 74080.26k
sign verify sign/s verify/s
rsa 2048 bits 0.020387s 0.000528s 49.1 1892.2
sign verify sign/s verify/s
dsa 2048 bits 0.005920s 0.006396s 168.9 156.3
Optimize for speed (-O3 instead of -Os and disable -DOPENSSL_SMALL_FOOTPRINT):
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
md5 14655.49k 48561.79k 126953.56k 210741.93k 262430.72k
sha1 14607.90k 47032.15k 117725.87k 188226.22k 228499.46k
des cbc 28041.11k 29586.84k 29939.80k 30047.91k 30067.37k
des ede3 10697.93k 10899.75k 10956.97k 10972.84k 10980.01k
aes-128 cbc 58852.70k 65956.07k 68675.67k 69388.29k 69607.42k
aes-192 cbc 50299.73k 56501.23k 58491.65k 59008.00k 59159.89k
aes-256 cbc 44684.38k 47944.36k 49098.67k 49573.89k 49463.30k
sha256 19673.53k 47248.58k 86775.04k 110053.72k 119382.02k
sha512 8029.67k 32033.02k 47440.04k 65740.12k 74072.06k
sign verify sign/s verify/s
rsa 2048 bits 0.019666s 0.000529s 50.8 1892.0
sign verify sign/s verify/s
dsa 2048 bits 0.005882s 0.006450s 170.0 155.0
=== D-Link DIR-860L (B1) ===
Default optimization:
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
md5 3376.97k 11654.74k 32966.76k 60016.27k 80729.43k
sha1 2310.95k 6024.87k 11680.32k 15273.93k 16784.07k
des cbc 6787.21k 7014.36k 7072.49k 7088.73k 7092.48k
des ede3 2462.47k 2499.87k 2509.48k 2511.35k 2514.75k
aes-128 cbc 10014.28k 11018.87k 11308.99k 11381.03k 11406.20k
aes-192 cbc 8930.35k 9675.27k 9895.97k 9954.57k 9971.92k
aes-256 cbc 8022.81k 8624.03k 8799.60k 8843.14k 8856.07k
sha256 2546.33k 5542.19k 9326.99k 11249.03k 11969.57k
sha512 877.22k 3503.44k 4856.01k 6554.96k 7299.32k
sign verify sign/s verify/s
rsa 2048 bits 0.109348s 0.003132s 9.1 319.3
sign verify sign/s verify/s
dsa 2048 bits 0.032745s 0.037212s 30.5 26.9
Optimize for speed (-O3 instead of -Os and disable -DOPENSSL_SMALL_FOOTPRINT):
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
md5 3660.39k 12401.37k 34501.23k 62438.83k 81786.64k
sha1 3500.20k 10730.70k 25056.19k 37715.86k 44253.13k
des cbc 7189.75k 7545.88k 7641.90k 7665.71k 7672.18k
des ede3 2690.64k 2734.33k 2745.24k 2748.13k 2748.81k
aes-128 cbc 11325.29k 12731.75k 13151.34k 13259.95k 13289.55k
aes-192 cbc 9932.36k 10997.65k 11309.84k 11389.53k 11408.92k
aes-256 cbc 8845.13k 9677.01k 9920.30k 9980.77k 9996.42k
sha256 3200.50k 7107.76k 12230.85k 14933.73k 15962.15k
sha512 879.12k 3510.79k 4956.45k 6711.45k 7484.39k
sign verify sign/s verify/s
rsa 2048 bits 0.085641s 0.002365s 11.7 422.9
sign verify sign/s verify/s
dsa 2048 bits 0.023881s 0.026120s 41.9 38.3
-O3 is considered safe for OpenSSL
Ref: https://wiki.openssl.org/index.php/Compilation_and_Installation
Tested hardware: Linksys WRT3200ACM / D-Link DIR-860L (B1)
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
2017-11-18 21:01:26 +01:00
f5468d2486
openssl: fix cryptodev config dependency
...
Signed-off-by: Ralph Sennhauser <ralph.sennhauser@gmail.com>
2017-11-06 16:39:41 +01:00
c0b15b3072
openssl: Make DTLS configurable.
...
Signed-off by: Rosen Penev <rosenp@gmail.com>
2016-09-27 17:50:22 +02:00
cd91f384ac
openssl: re-enable NPN by default
...
Several packages rely on it
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2016-07-24 14:43:44 +02:00
3ad8bc4366
openssl: add option to disable SRP support
...
Signed-off-by: Dirk Feytons <dirk.feytons@gmail.com>
2016-07-23 12:10:41 +02:00
f16fc21675
openssl: add option to disable PSK support
...
Signed-off-by: Dirk Feytons <dirk.feytons@gmail.com>
2016-07-23 11:59:31 +02:00
0099748fd6
openssl: add option for NPN support
...
NPN has been superseded by ALPN so NPN is disabled by default
The patch has been sent to OpenSSL for inclusion, see
https://github.com/openssl/openssl/pull/1100
Signed-off-by: Dirk Feytons <dirk.feytons@gmail.com>
2016-07-23 11:59:31 +02:00
eb4fc91a81
openssl: add option to disable compression support
...
By default it's disabled. After the CRIME attack it seems the use of
compression is discouraged.
Signed-off-by: Dirk Feytons <dirk.feytons@gmail.com>
2016-07-23 11:59:31 +02:00
db11695aa6
openssl: add option to omit deprecated APIs
...
Signed-off-by: Dirk Feytons <dirk.feytons@gmail.com>
2016-07-23 11:59:30 +02:00
8de052800a
openssl: remove the separate configuration menu, use the implicit one (via MENU:=1)
...
Fixes warning on selecting OPENSSL_ENGINE_CRYPTO if openssl is not selected
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 48312
2016-01-18 12:42:08 +00:00
f1d3b08fc0
openssl: add config option for no_hw support
...
The hardware support is required by some 3rd party engines (tpm)
Signed-off-by: Florian Eckert <Eckert.Florian@googlemail.com>
SVN-Revision: 47817
2015-12-09 22:26:40 +00:00
6a4a437e04
openssl: optimize build options, disable old SSL versions
...
Based on a patchset by Etienne CHAMPETIER <champetier.etienne@gmail.com>
Signed-off-by: Steven Barth <steven@midlink.org>
SVN-Revision: 43123
2014-10-30 13:11:04 +00:00
ca186db09f
openssl: enable elliptic curve crypto by default (so that it can be used by things like ipsec as well)
...
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 37524
2013-07-24 12:38:06 +00:00
da654a0c42
openssl: add elliptic curve crypto compilation options to openssl
...
This patch adds EC compilation options to openssl
OPENSSL_WITH_EC is needed for authsae (OPENSSL_WITH_EC2M isn't)
Activating ec (but not ec2m) in openssl take 35Ko more on ar71xx (ipk size)
Activating both take 52Ko.
Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>
SVN-Revision: 37523
2013-07-24 12:37:55 +00:00
96bb7c123b
build: consistently use 'depends on' instead of 'depends'
...
make the syntax more compatible with kernel menuconfig
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 36351
2013-04-17 15:36:41 +00:00
48db59fab7
move library packages to package/libs/
...
SVN-Revision: 33657
2012-10-08 11:24:12 +00:00
Matthias Schiffer
Daniel Engberg
Ralph Sennhauser
Rosen Penev
Felix Fietkau
Dirk Feytons
Felix Fietkau
Hauke Mehrtens
Steven Barth